Token sharing system and method

• US 20070016943A1
• Filed: 05/05/2006
• Published: 01/18/2007
• Est. Priority Date: 05/06/2005
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Bajaj, Siddharth, Popp, Nicolas, M'Raihi, David
• Granted Patent: US 9,185,108 B2
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G07C 9/27 with central registration
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

A scalable system and method for authenticating entities such as consumers to entities with a diverse set of authentication requirements, such as merchants, banks, vendors, other consumers, and so on. An authentication credential such as a token can be shared among several resources as a way to authenticate the credential owner.

Claims

1. An authentication system, comprising:

a token constructed and arranged to have an identifier and to generate a one time password;

a one time password validation server constructed and arranged to validate the one time password generated by the token, the validation server having a network address;

a token lookup service constructed and arranged to correlate a token identifier with a network location of the validation server;

a resource validation server constructed and arranged to validate at least a first authentication factor provided by a user of the token, and to send a request for the location of the one time password validation server to the token lookup server if the first factor is successfully validated and to send a one time password validation request to the one time password validation server.

2. The system of claim 1, wherein the first authentication factor provided by the user of the token includes a username.

3. The system of claim 1, wherein the first authentication factor provided by the user of the token includes secret shared between the user of the token and the resource validation service.

4. A token lookup server, including:

a processor;

a memory coupled to the processor, the processor and memory constructed and arranged to store a network address of a one time password validation server and a token identifier, wherein the one time password validation server is constructed and arranged to validate a one time password generated by a token that corresponds to the token identifier.

5. The token lookup server of claim 4, wherein the processor and memory are further constructed and adapted to receive a request for a network address for a one time password validation server for a token, the request including a token identifier corresponding to the token, determine a network address that corresponds to the received token identifier and to send the determined network address in response to the request.

6. A method for authentication, including:

receiving at a token lookup service a request for a network address of a one time password validation server, the request including a token identifier;

determining a network address corresponding to a once time password validation server and the received token identifier; and

sending the network address in response to the request.